# C1 Security Review Checklist

Status: signed off for the Hello World C1 milestone implementation.

- Package name, version, and URL are not used as execution identity.
- Importing a package does not create trust automatically.
- Verifying a signed claim does not create trust automatically.
- Authentication alone does not create authority without trust and capability records.
- WASM artifact bytes are verified before execution.
- WASM modules with imports are denied before execution.
- Package JavaScript execution is not allowed.
- `eval` is not used by package execution.
- Package code is not given DOM access.
- Package code is not given IndexedDB, localStorage, raw document store, or raw blob store access.
- Station private keys are not exposed through the package ABI.
- Station private keys and raw secret material are excluded from trace capsule export.
- Backend authority is not required for local Hello World.
- Telemetry is not enabled by default.
- Missing blobs fail closed and do not trigger silent remote fetch.
- Importing a trace capsule leaves imported trust inactive until local re-approval.
- Failure paths leave invocation, evidence, effect, or audit records.
